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Abstract 

Most quantum algorithms that give an exponential speedup over classical algorithms exploit the 
Fourier transform in some way. In Shor's algorithm, sampling from the quantum Fourier spectrum is 
used to discover periodicity of the modular exponentiation function. In a generalization of this idea, 
quantum Fourier sampling can be used to discover hidden subgroup structures of some functions much 
more efficiently than it is possible classically. Another problem for which the Fourier transform has 
been recruited successfully on a quantum computer is the hidden shift problem. Quantum algorithms for 
hidden shift problems usually have a slightly different flavor from hidden subgroup algorithms, as they 
use the Fourier transform to perform a correlation with a given reference function, instead of sampling 
from the Fourier spectrum directly. In this paper we show that hidden shifts can be extracted efficiently 
from Boolean functions that are quadratic forms. We also show how to identify an unknown quadratic 
form on n variables using a linear number of queries, in contrast to the classical case were this takes 
6(n 2 ) many queries to a black box. What is more, we show that our quantum algorithm is robust in the 
sense that it can also infer the shift if the function is close to a quadratic, where we consider a Boolean 
function to be close to a quadratic if it has a large Gowers U3 norm. 

1 Introduction 

Fourier analysis has a wide range of applications in computer science including signal processing, cryp- 
tography, Boolean functions, just to name a few. The fast Fourier transform (FFT) algorithm provides an 
efficient way to compute the discrete Fourier transform of length N in time 0(N log N). This is a significant 
improvement over the naive 0(N 2 ) implementation and allows to apply Fourier analysis to correlation prob- 
lems, to image and audio processing, efficient decoding of error-correcting codes, data compression, etc. In 
a more theoretical context, the Fourier transform over the Boolean hypercube — also called Walsh-Hadamard 
transform — is used to study certain classes of Boolean functions, for instance monotone functions, functions 
with constant depth, and functions with variables of high influence. 

In quantum computing, Fourier transforms have turned out to be extremely successful tools and feature 
prominently in quantum algorithms that achieve exponential speedups. The prime examples are Shor's al- 
gorithms for discrete log and factoring [Sho97 ]. Indeed, the quantum computer can sample from the Fourier 
spectrum on N points in quantum time 0(log 2 N), a big advantage over the classical case. Here "quantum 
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time" is measured in terms of elementary quantum gates that are needed to implement the unitary operation 
corresponding to the Fourier transform. This possibility of performing a quantum Fourier transform more 
efficiently than in the classical case has a tremendous upside and much of the power of quantum computing 
stems from there. This fact has been leveraged for instance for the solution of the abelian hidden sub- 
group problem (HSP) which essentially is solved by sampling from the Fourier spectrum of a given function 
[ME98, BH97, Kit97|. The hidden subgroup, a secret property of the function, can then be inferred by a 
subsequent classical post-processing. 

However, the high hopes that Fourier sampling might lead to efficient quantum algorithms for HSPs 
over general non-abelian groups, including cases that would encompass the famous graph isomorphism 
problem, have been somewhat dampened recently, as flHMR + 06t showed that new techniques to design 
highly entangling measurements would be required in order for the standard approach to succeed. Perhaps 
for this reason, the field of quantum algorithms has seen a shift towards other algebraic problems such as 
the algorithm for finding hidden nonlinear structures ICSV071 . The techniques to tackle those problems are 
still based on Fourier analysis but have a different flavor than the HSP. 

Classically, besides allowing for sampling from the spectrum the importance of the Fourier transform for 
performing correlation tasks cannot be overstated. Therefore, it is very natural to try to leverage the quantum 
computer's exponential speedup at computing Fourier transforms to compute correlations efficiently. It turns 
out, however, that this task is an extremely challenging one. First of all, it can be shown that it is impossible 
to compute correlations between two unknown vectors of data due to requirement for the time evolution to 
be unitary and the fact that the correlation between two inputs is a non-linear map of the inputs. For some 
special problems, however, in which one of the inputs is a fixed, known vector of data, correlations can be 
computed. This question becomes relevant in particular for hidden shift problems, where correlations can 
be used in a particularly fruitful way. These problems ask to identify a hidden shift provided that access to 
a function f(x) and a shifted version g(x) = f(x + s) of the function is given. Formally, the hidden shift 
problem is defined as follows: 

Given: Finite group G, finite set R, maps f,g:G—>R. 
Promise: There exists s£G such that g(x) = f(x + s) for all x G G. 
Task: Find s. 

The first example of a problem of this kind that was solved on a quantum computer was f(x) being 
the Legendre symbol and s being an unknown element of the cyclic group Z p modulo a prime. As shown 
in HDHI03L for the Legendre symbol the hidden shift s can be found efficiently on a quantum computer. 
The key observation is that the Legendre function is an eigenfunction of the Fourier transform for the cyclic 
group Z p . This fact can be used to compute a correlation of a shifted Legendre symbol with the Legendre 
symbol itself by using the convolution theorem, involving the application of two discrete Fourier transforms 
over Z p . 

Our results. We present an efficient quantum algorithm to solve the hidden shift problem for a class of 
quadratic Boolean functions for which the associated quadratic form is non-degenerate. Those functions are 
special cases of what is known as bent functions [Rot76L An intriguing property of these functions is that, 
in absolute values, they have a perfectly flat Fourier spectrum. In general, bent functions are those Boolean 
functions for which the Hamming distance to the set of all linear Boolean functions is maximum, where 
distance is measured by Hamming distance between their truth tables. A quantum algorithm to solve the 
hidden shift problem for bent functions has been studied in [Rot08 ], where the emphasis is on the richness of 
different classes of bent functions for which a hidden shift problem can be defined and solved. In this paper, 
in contrast, we restrict ourselves to just one class of bent functions, namely the quadratic forms, and study 
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a different question: is it possible to solve the hidden shift problem also in cases where a given function / 
is actually not a quadratic form, but close to a quadratic form? We answer this question in the affirmative, 
provided that / is not "too far" from a quadratic form, where we measure closeness by the Gowers norm. 
We give a quantum algorithm that can find a hidden shift for functions that are close to quadratics by using a 
simple idea: first, we give a quantum algorithm that finds this quadratic form. Then we solve the hidden shift 
problem for this quadratic form by resorting to the hidden shift algorithm for the bent function case (the case 
where the corresponding quadratic form is not of full rank can be taken care without major complications), 
and finally we use a test to determine whether the resulting candidate shift is indeed the correct answer. 
Overall, we obtain an algorithm that solves the hidden shift for functions of large Gowers norms using 0(n) 
queries to the functions. The classical lower bound for such functions is at least J7(n 2 ) (for the case of 
perfect quadratics), but we conjecture that for the case of functions that are close to quadratics, actually the 
classical query complexity scales exponentially. 

Related work. We already mentioned [Rot08] which addressed the hidden shift problem for bent func- 
tions and which constitutes a building block for our algorithm. The hidden shift problem itself goes back 
to MDHI0311 . in which an algorithm similar to our Algorithm 13. II was used in order to correlate a shifted 
function with a given reference function, thereby solving a deconvolution problem. The main difference 
with the present work is the departure from functions that have perfectly flat Fourier spectrum. 

Our algorithm in Section[3]to identify the quadratic function is similar to the methods used in MCSV071 
DDW09, BCD05] to extract information about functions that have been encoded into the phases of quantum 
states. Related to the considered hidden shift problem is also the work by Russell and Shparlinski [RS04] 
who considered shift problems for the case of x(/(a?)), where / is a polynomial on a finite group G and 
X a character of G, a general setup that includes our scenario. The two cases for which algorithms were 
given in [RS04] are the reconstruction of a monic, square-free polynomial / £ F p [X], where x i s the 
quadratic character (Legendre symbol) over ¥ p and the reconstruction of a hidden shift over a finite group 
x{sx), where x i s the character of a known irreducible representation of G. The technique used in [RS04] 
is a generalization to the technique of MDHI031 . It should be noted that we use a different technique in 
our algorithm, namely we combine and entangle two states that are obtained from querying the function, 
whereas [RS04] has more the flavor of a "single register" algorithm. Another difference is that our algorithm 
is time efficient, i. e., fully polynomial in the input size, whereas |RS04] is query efficient only. 

In a broader context, related to the hidden shift problem is the problem of unknown shifts, i. e., problems 
in which we are given a supply of quantum states of the form \D + s), where s is random, and D has to be 
identified. Problems of this kind have been studied by Childs, Vazirani, and Schulman MCSV07I1 . where D 
is a sphere of unknown radius, Decker, Draisma, and Wocjan [DDW09], where D is a graph of a function, 
and Montanaro [Mon09 ], where D is the set of points of a fixed Hamming- weight. The latter paper also 
considers the cases where D hides other Boolean functions such as juntas, a problem that was also studied 
in llAS07l . 

2 Fourier analysis of Boolean functions 

First we briefly recall the Fourier representation of a real valued function / : K> — > M on the n-dimensional 
Boolean hypercube. For any subset SC[n] = {l,,..,n} there is a character of Zj via xs '■ % l— » (—l) Sx , 
where x £ Z£ (the transpose is necessary as we assume that all vectors are row vectors) and S £ Z?> in the 
natural way. The inner product of two functions on the hypercube is defined as (/, g) = Yl x f( x )9( x ) = 
^x(fg)- The xs are inequivalent character of Zg, hence they obey the orthogonality relation E, x (xsXt) = 
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5s,T- The Fourier transform of / is a function / : Z?j — > R defined by 

7(5) = Estfxs) = ^ E Xs(x)f(x), (1) 

/(5) is the Fourier coefficient of / at frequency 5, the set of all Fourier coefficients is called the Fourier 
spectrum of / and we have the representation / = f(S)xs- The convolution property is useful for our 
purposes, namely that / * g(S) = f(S)g(S) for all S where the convolution (/ * g) of two functions /, g 
is the function defined as (/ * g)(x) = ^ X^yez n f( x + y)s{y)- I n quantum notation the Fourier transform 
on the Boolean hypercube differs slightly in terms of the normalization and is given by the unitary matrix 

H ^ = ~k E (-!)^ l*> (v\ > 

which is also sometimes called Hadamard transform IINCOOII . Note that the Fourier spectrum defined with 
respect to the Hadamard transform which differs from dTJ) by a factor of 2~ n / 2 . It is immediate from the 
definition of H 2 n that it can be written in terms of a tensor (Kronecker) product of the Hadamard matrix 
of size 2x2, namely = (H2)® 11 , a fact which makes this transform appealing to use on a quantum 
computer since can be computed using 0(n) elementary operations. 

For Boolean functions / : ZJf ~~ * ^2 with values in Z2 we tacitly assume that the real valued function 
corresponding to / is actually F : x 1— ► {—l)^ x \ The Fourier transform is then defined with respect to F, 
i. .e, we obtain that 

^H = ^ E(- 1 ) OT<+/( " ) ' (2) 

where we use wGZ™ instead of S C [n] to denote the frequencies. Other than this notational convention, 
the Fourier transform used in (f2]) for Boolean valued functions and the Fourier transform used in ([TJ) for real 
valued functions are the same. In the paper we will sloppily identify f = F and it will be clear from the 
context which definition has to be used. 

We review some basic facts about Boolean quadratic functions. Recall that any quadratic Boolean 
function / has the form f(x%, . . . , x n ) = X^<j 9i,j x i x j + Y^i which can be written as f(x) = xQx 1 + 
Lx l , where x = (x\, . . . , x n ) G Z£ . Here, Q S F% xn is an upper triangular matrix and L € Ff. Note that 
since we are working over the Boolean numbers, we can without loss of generality assume that the diagonal 
of Q is zero (otherwise, we can absorb the terms into L). It is useful to consider the associated symplectic 
matrix B = (Q + Q*) with zero diagonal which defines a symplectic form B(u, v) = uBv 1 . This form 
is non-degenerate if and only if rank(l?) = n. The coset of / + R(n, 1) of the first order Reed-Muller 
code is described by the rank of B. This follows from Dickson's theorem [MS77] which gives a complete 
classification of symplectic forms over Z2: 

Theorem 1 (Dickson |MS77l). Let B 6 Zg Xn be symmetric with zero diagonal (such matrices are also 
called symplectic matrices). Then there exists R 6 GL(n, Z2) and h £ [n/2] such that RBR 1 = D, where 
D is the matrix (1^ (g) a x ) © n -2h considered as a matrix over Z2 (where a x is the permutation matrix 
corresponding to (1,2)). In particular, the rank of B is always even. Furthermore, under the base change 
given by R, the function f becomes the quadratic form iph(x\, . . . , x^h) + L'{x\, . . . , x n ) where we used 
the inner product function iph and a linear function L'. 
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Let f(x) = xQx 1 + Lx l be a quadratic Boolean function such that the associated symplectic matrix 
B = (Q + Q*) satisfies rank(l?) = 2h = n. Then the corresponding quadratic form is a so-called bent 
function I Rot76l IDil75 1 IMS 771 . In general, bent functions are characterized as the functions / whose Fourier 

coefficients f(w) = ± £ a , eZ ft(-l) wet+/(<B > satisf y I /Ml = 2 ~™ /2 for a11 w G Z 2> i- e -» the spectrum of 
/ is flat. It is easy to see that bent functions can only exist if n is even and that affine transforms of bent 
functions are again bent functions. Indeed, let / be a bent function, let A G GL(n, Z2) and b G Zg, and 
define ^(x) := /(x.A + 6). Then also g(x) is a bent function and g(w) = (-l)- wh f{w{A" 1 ) t ) for all 
w G ZJ,. A very simple, but important observation is that if / is bent, then this implicitly defines another 

Boolean function via 2 n/2 /(w) =: Then this function / is again a bent function and called the 

dual bent function of /. By taking the dual twice we obtain / back: f = f. 

Theorem [Hallows us to define a whole class of bent functions, namely the Boolean quadratics for which 
B = (Q + Q l ) has maximal rank. It is easy to see that under suitable choice of Q, so instance the inner 

product function ip n (xi, . . . , x n ) = Y?h=i x 2i-\%2i can be written in this way. Using affine transformations 
we can easily produce other bent functions from the inner product function and Theorem Q] also implies that 
up to affine transformations the quadratic bent functions are equivalent to the inner product function. From 
this argument also follows that the dual of a quadratic bent function is again a quadratic bent function, a fact 
that will be used later on in the algorithm for the hidden shift problem over quadratic bent functions. 

3 The hidden shift problem for quadratics 

Let n > 1 and let O be an oracle which gives access to two Boolean functions /, g : ZJ? — > Z2 such that 
there exists s £ such that g(x) = f{x + s) for all x G Z?j. The hidden shift problem is to find s by 
making as few queries to O as possible. If / is a bent function, whence also g since it is an affine transform 
of /, then the hidden shift can be efficiently extracted using the following standard algorithm. Recall that 
Boolean functions are assumed to be computed into the phase. This is no restriction, as whenever we have a 
function implemented as \x) |0) 1— ► \x) \f(x)), we can also compute / into the phase as \x) 1— ► 

(_!)/(*) by 

applying / to a qubit initialized in ;4g(|0) — |1)). 

Algorithm 3.1 (Standard algorithm for the hidden shift problem [DHI031). 

Input: Boolean functions f, g such that g(x) = f(x + s). Output: hidden shift s. 

(i) Prepare the initial state |0). 

(ii) Apply Fourier transform Hf n to prepare equal distribution of all inputs: 
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( Hi) Compute the shifted function into the phase to get 




(iv) Apply J3| 



to get 
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(v) Compute the function \w) *—> (— into the phase resulting in 



j>ir ( \w) . 



w 



(vi) Finally, apply another Hadamard transform H® 11 to get \s) and measure s. 

The function / that has been used in Step (iv) can only be applied by means of a unitary operation if the 
Fourier spectrum of / is flat, in other words if / is a bent function. See also [Rot08] for several classes of 
bent functions to which this algorithm has been applied. Note that Algorithm 13. 1 I requires only one query to 
g and one query to /. Furthermore, the quantum running time is 0(n) and the algorithm is exact, i. e., zero 
error. Note that Step (iii) of Algorithm 13.11 assumes that the Fourier transform of / is flat. 

There is an intriguing connection between the hidden shift problem for injective functions /, g and the 
hidden subgroup problem over semidirect products of the form A x Z 2 where the action is given by inversion 
in A ]KupQ5| rFIM + 03t . In our case the functions are not injective, however, it is possible to exploit the 
property of being bent to derive another injective "quantum" function: F(x) := ^== Yl y (~ l)^ x+y ^ \y) 
(similarly a function G can be derived from g). Now, an instance of an abelian hidden subgroup problem 
in xi 1>2 can be defined via the hiding function H(x, b) that evaluates to F(x), if b = 0, and to G(x), 
if b = 1. This reduction leads to an algorithm that is different from Algorithm 13. II but also can be used to 
compute the shift. 

Now, we consider a different task: we begin with an arbitrary quadratic Boolean function (not nec- 
essarily bent) /, which is given by an oracle O. We show that / can be discovered using 0(n) quan- 
tum queries to O, whereas showing a lower bound of $7(n 2 ) classical queries is straightforward. Re- 
call that Bernstein and Vazirani HBV971 solved the case of linear function /. We use quadratic forms 
f(xi, ... ,x n ) = Y^i<j H,j x i x j + Y^i ^i x i written as f(x) = xQx 1 + Lx\ where x = (x%, . . . , x n ) £ Z%. 
Here, Q G Zg*™ is an upper triangular matrix and L £ ZJ;. Using the oracle we can compute the function 
into the phase and obtain the state 



We will show next, that Q and L can be obtained from a linear number of copies of The method uses 
two such states at a time and combines them using the unitary transform defined by 



Note that T can be implemented efficiently on a quantum computer as it is just a controlled not between 
each qubit in the y register as source to the corresponding qubit in the x register as target, followed by a 
Hadamard transform of each qubit in the y register. The following computation shows that T can be used to 




(3) 



T : \x,y) 
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extract information about Q from two copies of \ip). 



r|^>®w = T(^Y.(- l ) xQxt+yQyt+L{x+y)t \ x >y)) 

_ /_j\wQu*+u(Q+Q*)a*+i'U t +z(a;+'!i) t | u ^\ 

, /o3n ^— ' 

_L ^(-l^+^lu.ucg + g*)). 



Hence this state has the form |w, it(Q + Q*))> where p is the quadratic Boolean function 

p(u) = uQ tr d + Lu l . 

We now describe a direct way to recover / from sampling from these states. Suppose we sample k = 
0(n) times, obtaining pairs (ui,V{) from this process. The goal is to identify the matrix Q. Observe that 
learning what Q is equivalent to learning what M := (Q + Q l ) is since Q is an upper triangular matrix 
with zero diagonal. Now, arrange the sampled vectors m into a matrix U = (u\ \ . . . \uk) and similarly 
V = (vi \ . . . Then U l M = V 1 is a system of linear equations for each of the n columns of M. Since 
the matrix U was chosen at random, we obtain that it is invertible with constant probability, i. e., we can find 
M with constant probability of success. 

We shall now improve this in order to obtain a method that is more robust regarding errors in the input 
state \ip). Instead of sampling k times from T \i/j)® 2 , we consider the coherent superposition |^)® 2fc and 
apply T® k to it. The resulting state has the form 

^2 <p(ui, ■ ■ ■ , u k) \uu ■ ■ ■ ,u k ) \Mui, . . . ,Mu k ) , (4) 



u 1; ...,u k 



with certain phases, indicated by cp. Next, note that there is an efficient classical algorithm which on input U 
and V computes the matrix M. We can compute this algorithm in a reversible fashion and apply to the state 
(01). The resulting state has constant overlap with a state that is the superposition of the cases for which the 
Gauss algorithm computation was successful (returning M) and those cases for which it was unsuccessful 
(returning _L): using the shorthand notation u = [u%, . . . , life), we obtain the state 

<p{u) |u) |Mu) J \M) + ( Y, ^( u ) l u > l Mu ) ) l-L) • 

u good / \u bad / 

Measuring this state will yield M with constant probability. Once M has been found, we can infer Q and 
uses this information to compute it into the phases in equation (O in order to cancel the quadratic part out. 
From the resulting states we can efficiently determine L from a constant number of subsequent Fourier 
samplings. 



Relation to learning parity with errors We now return to the hidden shift problem. In the following we 
argue that the quantum algorithm for finding a shift for quadratic functions has an advantage over classical 
attempts to do so, since it can even handle cases where the function is close to a quadratic function. It 
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is easy to see that the shift problem for quadratic functions themselves can be solved classically in 6(n) 
queries: the lower bound is a straightforward information-theoretic argument. For the upper bound we show 
that from knowledge of the quadratics and the promise that there is a shift s such that g(x) = f(x + s), 
we can determine s. Indeed, it is sufficient to query at points (0, . . . , 0), and e^, where denotes the ith 
vector in the standard basis to get equations of the form su\ = b{, where Ui € ZJ> and bi € Z2. With 
constant probability after n trials the solution is uniquely characterized and can be efficiently found, e. g., 
by Gaussian elimination. The problem with this approach is that if / and g are not perfect quadratics, the 
resulting equations will be 

su\ w e 61, su\ w e b 2 , ... 

where the ss e symbol means that each equation can be incorrect with probability 1 — e. As it turns out from 
Theorem [2] below, we will be able to tolerate noise of the order e = 0(1 /n). It is perhaps interesting to 
note that similar equations with errors have been studied in learning. The best known algorithm is the Blum- 
Kalai-Wasserman sieve [BKW03], running in subexponential time in n, albeit able to tolerate constant error 

£. 

We show that the following algorithm for computing an approximating quadratic form is robust with 
respect to errors in the input function: 

Algorithm 3.2. [Find-Close-Quadratic] The following algorithm takes as input a black-box for a Boolean 
function f. The output is a quadratic Boolean function which approximates f. 

• Prepare 2k copies of the state -j= Yl x (~ l)^ x ^ \%)> 



/2 r ' 

• Group them into pairs of 2 registers and apply the transformation T to each pair. 

• Rearrange the register pairs [1, 2], [3, 4], . . . , [2k— 1, 2k] into a list of the form [1, 3, . . . , k, 2, 4, . . . , 2k]. 
Next, apply the reversible Gauss algorithm to the sequence of registers. 

• Measure the register holding the result of the Gauss algorithm computation and obtain M £ Zg*™. 
Use M to uncompute the quadratic phase and extract the linear term via Fourier sampling. 

Theorem 2. Let f ', g : ZJ? — > Z2 be Boolean functions, let g = Y2i j Qi,j x i x j + Yli^i x i ^ e a quadratic 
polynomial, and assume that \ (f,g)\ > (1 — e). Then algorithm running Find-Close-Quadratic on input 
f finds the quadratic form corresponding to g, and thereby g itself with probability p SU ccess > c(l — ne), 
where c is a constant independent ofn. 

Proof. First note that | (/, g) \ > (1 — s) implies that / and g disagree on at most e2 n of the inputs. Hence 
the two quantum states \ip f ) = -}= J2x f( x ) \ x ) and \^g) = ^ J2 x 9i x ) \ x ) satisfy \(ipf\ip g }\ > (1 - e). 

Next, observe that the algorithm can be seen as application of a unitary operation U. We first study 
the "perfect" case, where we apply U to the state \ipg) and then study the effect of replacing this with the 
input corresponding to /. Notice that the algorithm can also be seen as a POVM M. which consists of rank 1 
projectors {Ei : i G 1} such that J2iei = 1- Since the algorithm identifies M with constant probability, 
we obtain that the POVM element Em, which corresponds to the correct answer satisfies Pr (measure M) = 

tv(E M \^ k )(^f k \) =uo>n(i). 

For vectors v, w we have that \\v — w\\2 = 2 — 2\(v,w)\, we get using \(4>f k \'4'f k )\ > (1 — z) k ~ 
(1 - ke) + 0(e 2 ). For the difference |<5) := ipf \ - \ipf) we therefore get that ||<5|| 2 < 2ke. Denoting 
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Em = \<p) (y| with normalized vector \tp), we obtain for the probability of identifying M on input /: 

) = (4, g \E M \4>f k ) + (5\E M \ipf k ) + (i,f\E M \6) + (5\E M \5) 
> p + 2(%><^f ) + |<%>| 2 . 

By Cauchy-Schwartz, we finally get that |(<5|</?)| < ||5|||M| < V2ke. Hence, we obtain for the overall 
probability of success p succe ss > Po — V8ke. □ 
We give an application of Theorem|2]to the problem of efficiently finding an approximation of a function 
of large Gowers U3 norm in the following section. 

4 Polynomials and the Gowers norm 

Recall that the Gowers norms measure the extent to which a function / : F ra —> C behaves like a phase 
polynomial. For k > 1, the Gowers norm is defined by 

||/||[/fe(F«) := (E a: ,/ ll) ... 1 ft fee F«A ftl . . . A hk f(x)) 

where Ahf(x) = f(x + h) — f(x) for all h G F n . It is immediate that if < 1 for all x, then 

ll/llc/ fc (F n ) Moreover, degree k polynomials are characterized precisely by the vanishing of 

A/ ll . . . Ah k f(x) for all hi. It is furthermore easy to see that ||/||[/fc(F n ) = 1 if and only if / is a phase 
polynomial of degree less than k [GT08 ]. 

Theorem 3 (Inverse theorem for the Gowers U3 norm [GTOH). Let f : ¥ n — > C be a function that is 
bounded as \f{x)\ < lfor all x. Suppose that the kth Gowers norm of f satisfies \\f\\u k (F n ) — 1 — e - Then 
there exists a phase polynomial g of degree less than k such that \\f — g\\ = o(l). For fixed field F and 
degree k, the o(l) term approaches zero as £ goes to zero. 

Before we state the algorithm we recall a useful method to compare two unknown quantum states for 
equality. This will be useful for a one-sided test that the output of the algorithm indeed is a valid shift. 

Lemma 4 (SWAP test [WatOO, BuhOTl). Let \ip), \(p) be quantum states, and denote by SWAP the quantum 
operation which maps \ifj) \(p) \ip) and by A(SWAP) the same operations but controlled to a 
classical bit. Apply (H2 <S> 1)A(SWAP)(H2 <g> 1) to the state |0) \(p) measure the first qubit in the 
standard basis to obtain a bit b and return the result (where result 6=1 indicates that the states are 
different). Then Pr(b = 1) = \ - ^|(^|V')| 2 - 

Lemma|4]has many uses in quantum computing, see for instance [WatOO, BuhOl ]. Basically, it is useful 
whenever given \ip) and \ip) two cases have to be distinguished: (i) are the two states equal, or (ii) do they 
have inner product at most 5. For this case it provides a one-sided test such that Pr(b = 1) = if \ip) = \cp) 

and Pr(b = 1) > ±(1 - 5 2 ) if / \<p) and < 5. 

Algorithm 4.1. [Shifted-Large-U3] The following algorithm solves the hidden shift problem for an oracle 
O which hides (f, g), where g(x) = f(x + s)for s £ and where ||/||tr 3 (z 2 ) > (1 — e). 

1. Solve the hidden quadratic problem for f. This gives a quadratic g(x) = xQx 1 + Lx l . 

2. Compute the dual quadratic function corresponding to the Fourier transform of g. 



tr E M 



in 
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3. Solve the hidden shift problem for fix), f(x + s), and g. Obtain a candidate s E Z^. 

4. Verify s using the SWAP test. 

Theorem 5. Let f be a Boolean function with \\f\\u 3 > 1 — e. Then Algorithm \4. 1 1 fShifted-Large-U3 ) 

solves the hidden shift problem for f with probability p success > c(l — e), where c is a universal constant. 

Proof sketch. In general the fact that large Gowers Us norm implies large correlation with a quadratic 
follows from the inverse theorem for Gowers Us norm IGT081 ISam07l . For the special case of the field 
Z2 and the large Gowers norm (1 — e) we are interested in, we use ||AKK + Q3l to obtain a stronger bound 
on the correlation with the quadratics. The claimed result follows from [AKK+03] and the robustness of 
Algorithm 14. 1 1 against errors in the input functions. □ 

Remark 6. It should be noted that in the form stated, Algorithm 14. 1 1 only applies to the case where the rank 
h = ik(Q + Q t )/2 = re/2 is maximum, as only this case corresponds to bent functions. However, it is easy 
to see that it can be applied in case h < n/2 as well. There the matrix (Q + Q f ) has a non-trivial kernel, 
defining a n — 2h dimensional linear subspace of Z^. In the Fourier transform, the function is supported on 
an affme shift of dual space, i. e., the function has 2 2h non-zero Fourier coefficients, all of which have the 
same absolute value 2~ h . Now, the hidden shift algorithm can be applied in this case too: instead of the dual 
bent function we compute the Boolean function corresponding to the first 2h rows of (iT 1 )*, where R is as 
in Theorem Q] into the phase. This will have the effect of producing a shift s lying in an affme space s + V 
of dimension n — 2h. For h < n/2 the shift is no longer uniquely determined, however, we can describe the 
set of all shifts efficiently in that case by giving one shift and identifying a basis for V. 

5 Conclusions and open problems 

It is an interesting question is whether the quantum algorithm to find approximations for functions for 
large Gowers norms U2 and U3 can be used to find new linear and quadratic tests for Boolean functions. 
Furthermore, it would be interesting to study the tradeoff between number of queries and soundness for 
quantum tests, in analogy to the results that have been shown in the classical case [ST06]. 
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